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Entry Vehicle Control 


1. INTRODUCTION 

Almost every spacecraft requires an active attitude stabilization and control system during 
atmospheric entry to steer the vehicle in accordance with the guidance commands, to 
prevent undesired vehicle oscillations, to aline the vehicle for terminal landing, and to steer 
the vehicle along a flightpath where aerodynamic heating and load limitations will not be 
exceeded. 

Factors that influence the design of the entry-control system include 

( 1 ) Vehicle mass and geometric characteristics 

(2) Vehicle aerodynamic characteristics 

(3) Vehicle aerodynamic-heating characteristics, and nature of the heat shield 

(4) Payload and crew physical limitations 

(5) Initial atmospheric entry conditions 

(6) Type of moment-generation devices available 

(7) Vehicle sensing and control equipment 

(8) Attitude accuracy and speed-of-response requirements 

(9) Crew safety and mission success requirements 

(10) Guidance-system and flightpath constraints 

Improper design or operation of the entry-control system can cause excessive attitude- 
control propellant consumption or large landing-position errors, or cause the entry vehicle 
to experience oscillatory motions that in extreme cases can cause loss of the vehicle or 
failure of the terminal-landing device. 

The entry-control system should make effective use of sensing, data processing, display, and 
control equipment required for other mission phases, so that a minimum of additional 
equipment and expendables is required for entry control. It should be as insensitive as 
possible to variations in vehicle parameters, atmospheric conditions, and initial entry 
conditions. It should make effective use of the crew’s capability for monitoring, backup, or 
manual control during entry. 

This monograph is applicable to all types of entry vehicles that use aerodynamic forces for 
deceleration. The entry phase of flight is assumed to begin with the orientation of the 
vehicle for entry into the atmosphere and to end at 100 000 ft altitude or deployment of 
the terminal-landing device. 
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The entry-control system is concerned with the vehicle attitude motions about the center of 
mass. It is closely coupled with the entry-guidance system, which is concerned with the 
motion of the vehicle center of mass along a desired flightpath. The guidance problem for 
entry vehicles is covered in NASA SP-8015. 


2. STATE OF THE ART 

The state of the art of entry control is derived primarily from design, development, and 
flight experience with the Mercury, Gemini, Apollo, X-15, ASSET, and PRIME vehicles, and 
from preliminary design studies of advanced logistics vehicles. The entry-control systems of 
these vehicles are briefly described and appraised. 


2.1 Mercury Entry Control 

Design of the Mercury entry-control system was strongly influenced by stringent 
requirements for crew safety; the necessity to minimize power consumption and weight; the 
desire for simple, highly reliable redundant modes; and an absolute requirement that the 
pilot have the capability • of controlling spacecraft attitude. Information on the system 
presented in references 1 to 6 is summarized below. 


2.1.1 System Description and Operation 

The Mercury entry vehicle was a nonlifting body that followed a ballistic trajectory in the 
atmosphere. Thus, no changes in the entry flightpath were possible after retrofire. The 
entry-control system was first used to establish and maintain the proper entry attitude (1.5 
deg nose down). When the deceleration reached 0.05 g, an entry mode was initiated in 
which pitch and yaw damping were provided to insure that oscillations would not exceed ±4 
deg/sec until deployment of the drogue chute. A steady roll rate of 10 to 12 deg/sec was 
maintained to minimize landing-point dispersions and equalize aerodynamic heating on the 
structure. 

There were four control systems on the vehicle that could be used singly or in various 
combinations: a fully automatic control as provided by the automatic stabilization and 
control system (ASCS), a completely manual proportional control (MP), and combinations 
of automatic and manual control as provided by the rate stabilization and control system 
(RSCS) or the fly-by-wire (FBW) type of manual control. All but the ASCS mode were 
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(MP) 


Figure 1 .—Mercury control-system functional diagram. 


controlled by pilot actuation of the three-axis hand controller. A functional diagram of the 
control system is shown in figure 1 . 

The two reaction-jet systems (A and B) were completely independent, with separate 
hydrogen peroxide fuel tanks, separate fuel-flow control valves, and separate sets of jet 
thrusters. The jet-thruster configurations are shown in figure 2 and table I. The ASCS and 
FBW arrangements were used to control the thrusters in system A, and the MP and RSCS 
modes controlled system B jets. Metered quantities of hydrogen peroxide were decomposed 
in silver-plated catalyst beds in each thruster to provide the desired impulse. 

In the MP system, mechanical linkages transmitted the hand-controller movements to 
proportional-control valves, which regulated the flow of fuel to the thrusters. This system 
required no electrical power. The RSCS used a combination of hand-controller positions and 
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Pitch down 



Bl, Al, Ala 


Roll right 



Figure 2— Mercury entry-control jet configuration. 


Table I.— Mercury Entry Control Jet Configuration 


Attitude 

command 

Reaction jet system A 

Reaction jet system B 

Jet 

Thrust 

Ob) 

Jet 

Thrust 

Ob) 

Pitch up 

A3/A3a 

24/1 

B3 

0-24 

Pitch down 

Al/Ala 

24/1 

Bl 

0-24 

Yaw right 

A2/A2a 

24/1 

B2 

0-24 

Yaw left 

A4/A4a 

24/1 

B4 

0-24 

Roll right 

A5 

6/1 

B6 

0-6 

Roll left 

A6 



6/1 

B5 

0-6 


the computing components of the automatic system to provide rate control. The FBW 
system was operated by movement of the hand controller to operate the solenoid control 
valves electrically. Certain control modes could be operated simultaneously, such as the 
ASCS and MP, or FBW and MP, to provide complete control even with certain malfunctions 
in each mode. 
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The ASCS included a two-degree-of-freedom directional gyro; a two-degree-of-freedom 
vertical gyro; pitch-, yaw-, and roll-rate gyros; an amplifier-calibrator unit; and a 0.05 g 
accelerometer switch. The outputs of the attitude and rate gyros were transmitted to the 
roll,, pitch, and yaw switching logic, which activated appropriate reaction-control thrusters 
to maintain the desired attitude and rates. Infrared-sensing horizon scanners provided 
attitude signals in roll and pitch to aline the attitude gyros. 

The RSCS provided rate damping in case of ASCS failure. Control-stick motion was 
transmitted to the rate damper by means of potentiometers attached to the stick. Spacecraft 
angular rates were made to follow stick displacement up to a maximum of 12 deg/sec for all 
axes. 

The astronaut could, at any time in the mission, switch off the ASCS or RSCS and control 
the capsule manually by the MP or the FBW systems. The proportional valves in the MP 
system were designed to provide a linear relation between hand-controller deflection and 
thrust. The astronaut, when exercising manual control, monitored attitude and attitude rate 
on indicators mounted on the control panel. The FBW included provision for high or low 
impulse from the thrusters. This provision allowed the astronaut to conserve fuel by using 
the low- thrust position when small corrections were required. 


2.1.2 Flight Experience 

Control-system failures of one type or another were experienced on all but one of the six 
manned Mercury flights. These failures were overcome because of the redundancy designed 
into the system and the ability of the pilot to exercise attitude control manually. The 
problems encountered are enumerated below without detailed comment. Further informa- 
tion may be found in reference 5. 

The single most prevalent malfunction in the control system during the early manned-flight 
program was the intermittent failure of the small 1-lb thrusters. This failure caused eaily 
termination of the MA-5 chimpanzee flight. In addition, during a manned suborbital flight 
(MR-3) a 6-lb thruster also failed to produce thrust when required. Redesign of the 
thrust-chamber assemblies (ref. 5) eliminated this problem on later flights. Horizon-scanner 
measurement errors occurred because of ct cold cloud effects, and on One mission, MA-7, a 
scanner circuit failure required the astronaut to establish spacecraft attitude for retrofire. 
Modifications described in reference 5 eliminated these problems. Although the control 
system performed satisfactorily during the MA-9 mission, an electrical short circuit that 
occurred at two of the power-carrying plugs of the ASCS made it necessary to use manual 
control during entry. An open circuit in the pitch-rate gyro input to the amplifier-calibrator 
of the ASCS caused the MA-4 spacecraft attitude to be in error at retrofire, which in turn 
resulted in a 75 n. mi. landing error. 
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2.2 Gemini Entry Control 

The Gemini entry-control system design was based on experience gained from Mercury; it 
was a more flexible system, which emphasized the pilot’s control ability. Flight safety was 
achieved by relying on simpler redundant systems. Information on the entry-control system 
presented in references 7 to 1 7 is summarized in the following section. 


2.2.1 System Description and Operation 

One of the objectives of the Gemini program was the development of active entry flightpath 
control to reach a precise landing point. The vehicle was axially symmetrical, with its center 
of mass offset from the centerline as shown in figure 3. It trimmed at an angle of attack that 
resulted in an average lift-drag ratio (L/D) of about 0.19. Trajectory control was 
accomplished by rolling the vehicle to the right or left in response to guidance-system or 
pilot commands. Zero lift was obtained (on the average) by continuously rolling the vehicle. 
Negative lift was not used. 

A functional block diagram of the Gemini guidance and control (G&C) system is shown in 
Figure 4. The control portion of the system includes the attitude-control and maneuver 
electronics (ACME), entry-control jets, attitude hand controller, and attitude display group. 
The ACME included two rate-gyro packages, each containing three orthogonally mounted 
rate gyros. 




Figure 3.— Gemini vehicle trim condition. 
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Figure 4.— Gemini entry G&C system. 


The ACME received inputs from the hand controllers, the inertial measurement unit (IMU), 
and the digital computer. It processed these signals and sent firing commands to the 
appropriate thrusters. The system operated with on-off rather than proportional commands 
to the thruster solenoids. This arrangement allowed the use of simple switch actuation for 
manual control. 

Rate signals were summed with the computer commands or IMU signals, and the output was 
also fed to the switch amplifiers. A logic block provided proportional coupling of roll rates 
into the yaw axis, which allowed coordinated maneuvers about the velocity vector during 
entry. 

Two rings (A and B) of eight 25-lb bipropellant thrusters provided attitude-control torques 
about the spacecraft pitch, yaw, and roll axes during entry. Each ring of eight thrusters was 
supplied by an independent propulsion system. The 16 thruster locations and firing logic are 
shown in figure 5. Hypergolic propellants (monomethyl hydrazine and nitrogen tetroxide) 
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command 

RCS jets 
fired 

Pitch up 

5 and 6 

Pitch down 

1 and 2 

Yaw right 

3 and 4 

Yaw left 

7 and 8 

Roll right 

3 and 7 

Roll left 

4 and 8 


Figure 5. -Gemini entry-control jet configuration. 

were used to insure fast propellant ignition. The following automatic and manual attitude- 
and rate-control modes were available during entry. 


Rate-Command Mode 

Rate-gyro outputs were compared in the ACME with hand-controller signals, and when the 
difference between the two signals exceeded the damping dead zone (±0.5 deg/sec), the 
proper reaction jets were fired. It was not recommended that this mode be used during 
entry because of the high propellant usage due to small deadbands. 


Direct Mode 

This represented a backup control mode used to provide spacecraft angular acceleration by 
two methods. In the first method, switches on the hand controller provided on-off 
commands directly to the thruster solenoid valves. This mode was highly reliable because no 
electronic circuitry was required for its operation. In the second method, switches on the 
hand controller provided signals to the ACME, which were converted to on-off commands 
to the thruster solenoid valves. 

Pulse Mode 

The pulse mode was designed primarily to minimize propellant expenditure while 
performing attitude maneuvers in the absence of external disturbance torques. In this mode, 
a short-duration command signal was applied to the thruster solenoid valve when the hand 
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controller was deflected from its centered position. Pulses could also be obtained by using 
the pulse switches. The astronauts used this mode mainly between retrofire and the 0.05 g 
point to maintain the horizon in a specified orientation in the windows. 


Entry Mode 

The spacecraft pitch and yaw rates were automatically maintained within the damping dead 
zone (±4 deg/sec) by the ACME. The electronic circuits of the pitch- and yaw-axis control 
were identical to those used in the rate-command mode except that commands were not 
accepted from the hand controller. Inputs from the guidance computer kept the spacecraft 
within 2 deg of the wind axis. A steady roll rate of 15 deg/sec was maintained for a zero-lift 
entry. 


Entry -Rate Command Mode 

This mode was used for manual entry-attitude control and f had operational characteristics 
identical to those of the rate-command mode, except that the damping deadbands 
corresponded to the entry-mode values (±2 deg and ±4 deg/sec), and roll-rate crossfeed was 
included in the yaw channel as in the entry mode. This inclusion caused the spacecraft to 
roll about the velocity vector rather than about the spacecraft roll axis. The pilot could use 
the attitude display to follow the computer-generated roll angle. 


2.2.2 Flight Experience 


The Gemini Program included 10 manned space flights during which the entry-control 
system and its operational modes were thoroughly exercised and all design objectives were 
demonstrated. A summary of the entry-control modes used and pertinent flight experience 
on the manned missions is given in table II. 


2.3 Apollo Entry Control 

Although early Apollo flights were Earth orbital, the primary emphasis in the design effort 
was on the more critical lunar return mission. Information on the entry-control system is 
presented in references 18 to 29. 
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Table II.— Entry Control Mode Summary for Gemini Missions 


Mission 

Mode 

Comment 

3 

Direct 

Relatively high pitch and yaw rates (20 deg/sec) 

4 

Entry rate 
command 

Computer failure during mission. Constant 15 deg/sec roll rate 
(zero lift) entry planned. After a roll rate was established 
additional buildup occurred because of a pitch thruster failure. 
Roll accelerations were produced as the pilot was damping initial 
pitch oscillations. Increasing roll rate caused increased yaw 
thruster activity to keep the yaw rate within the deadband. A 
maximum 65 deg/sec roll rate was reached approx 3 min before 
drogue chute deployment. Propellant almost depleted at this 
time. Jet interference of aerodynamic flow has been cited as 
probable cause. 

5 

Direct 

(approximately 3 min); 
rate command 

One ring used. Propellant near depletion at drogue deployment 
because of using rate-command (low-deadband) mode. 

6 

Rate command 

One ring used until all propellant was expended approximately 
14 sec after max q. Second ring initiated before drogue deploy- 
ment. Attributed to using low deadband mode. 

7 

Direct 

(approximately 57 sec); 
rate command 

One ring depleted before 125 000 ft altitude. Other ring 
activated. Attributed to using low deadband mode. 

8 

Entry 

rate command 

One ring depleted early in entry because the system was used 
after the separation from the Agena because of orbital system 
thruster failure. 

9 

Entry 

rate command 

Nominal propellant usage. 

10 

Entry 

rate command 

Nominal propellant usage. 

11 

Entry 

rate command 
(approximately) 

First automatic entry control. 

12 

Entry 

Nominal propellant usage. 
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2.3.1 System Description 

The Apollo command module (CM), like that of Gemini, was a symmetrical body with an 
offset center of mass (L/D ~ 0.28). Control of the entry flightpath was accomplished by 
rolling the vehicle. Although direct entries were normally planned, the supercircular entry 
velocity could produce a skipout trajectory that constituted the critical design path for the 
entry-control system. The functional control requirements for a skipout entry are shown in 
figure 6. The control modes changed as a deceleration of 0.05 g was reached during the 
initial entry, skipout, and second entry. The entry-control system parameters and their 
defining requirements are presented in table III. 

The overall G&C system for Apollo is shown in figure 7. Early flights in Earth orbit used the 
block 1 configuration. Subsequent flights used the block 2 system. In the block 1 design, 
the guidance-system signals went through the control system to operate the reaction-control 
jets. With the two systems connected in this series configuration, a failure in the control 
system would have incapacitated the guidance and navigation (G&N) system. 


Hold attitude during 

Maneuver to entry skinout for second entrv 



Range 


Figure 6.— Apollo entry-control functions for critical skipout trajectory. 
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Block 1 system 


Block 2 system 


Figure 7.— Apollo G&C system designs. 


Table III. —Apollo Entry Control System Requirements 


Parameter 

Value 

Requirement 

Rate deadband 

2 deg/sec 

Propellant minimization 

Attitude deadband: 
Maximum 
Minimum 

8 deg 
4 deg 

Propellant minimization and 
attitude hold for preentry 

Rate-to-attitude gain 

0.5—1/sec 

Propellant minimization 

Maximum commanded 
roll rate 

22.5 deg/sec 

Lift-vector orientation 
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The block 2 configuration, shown in figure 7, improved utilization of the two systems and 
made them electrically independent, so that a failure in one would not affect the other. In 
block 2, the G&N computer assumed the primary stabilization and control tasks. A manual 
and semiautomatic control system served as a backup to the primary system. With the 
backup attitude reference, the control system was sufficient to allow the crew to make a 
safe entry in the event of primary G&C system failure. The block 2 design illustrates the 
philosophy of using two nonidentical systems to achieve functional redundancy. 

The entry-control system functional diagram is illustrated in tigure 8. Attitude-error and 
rate-gyro feedback signals were limited to reduce the maximum maneuver rate in the 
interest of fuel economy. The output of the attitude hand controller was limited for the 
same reason. The switching amplifier and pseudo-rate logic provided an on-off pulse to the 
engine-select logic in response to the analog error signal input. The principle of operation of 
pseudo-rate logic is described in references 6 and 18. During entry (a > 0.05 g ) and during 
manual maneuvers, the pseudo-rate feedback was switched out to prevent an overdamped 
response. The control pulse entered the jet select logic, whose primary function was to 
provide electrical isolation of the jet driver circuits. The solenoid drivers applied a fixed 
voltage to the engine-control solenoid valves. Each solenoid control valve had primary and 
secondary coils. The primary coil provided the normal driving force. The secondary coils 



Figure 8— Apollo entry-control functional diagram. 
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were connected directly to the attitude hand controllers and were powered directly from 
the battery, thus providing a highly reliable backup control mode. 

There were three functionally identical reaction-jet control channels for roll, yaw, and pitch 
control. Vehicle attitude and rate were sensed by appropriate gyros, and signals were 
summed to drive switching amplifiers. Switching allowed an increase in the attitude 
deadband to conserve fuel when precise control was not required. For each channel, a 
switching amplifier drove a one-shot circuit that guaranteed a minimum time “on” 
command to the jet drivers. This arrangement eliminated the explosion hazard present from 
improper proportions of the hypergolic fuel and oxidizer. An additional coil on each 
solenoid valve was driven directly from switches near the end of travel of the three-axis 
attitude hand controller. These switches provide direct manual override in the event of 
failure of the atuomatic system. 

Manual control of the vehicle was accomplished by summing signals from the hand 
controller and signals from the rate gyros to command the jet drivers. Miscellaneous 
switching functions provided for disabling the attitude reference, the hand control, or the 
jet drivers under certain conditions. Provision was also made for direct input commands 
from the guidance computer to the jet drivers. 

Instrumentation and displays included a flight direction attitude indicator (FDAI), three 
needle-type indicators that displayed computed attitude error in body axes, and three 
needle-type displays of spacecraft rotational rates. The FDAI consisted of a servo-driven 
gimbaled ball with full and continuous rotational capabilities for display of pitch, yaw, and 
roll. 

The two identical and independent jet-thruster systems (A and B) are shown in figure 9. 
Both systems were operated simultaneously, but each system had the capability of providing 
the impulse required to perform the necessary preentry and entry maneuvers. The minimum 
impulse that could be provided by a thruster was 2.0 lb-sec. Each jet developed 100 lb of 
thrust. 


2.3.2 System Operation 


The modes of entry control are shown in figure 10. Automatic modes were available 
through the digital autopilot (primary) and the control system. Attitude information was 
obtained from the IMU. Rate information was obtained by differentiating the IMU gimbal 
angles in the CM digital computer. Thruster commands for attitude-hold or maneuvers were 
determined by logic in the computer. 
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2 and 4 

Pitch up 
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6 and 8 

Yaw left 

5 and 7 

Roll left 

10 and 11 

Roll right 

9 and 12 


Figure' 9. -Apollo CM reaction-jet control system. 



Figure 10.— Apollo entry-control modes. 


In the backup control system, attitude hold was accomplished by an analog system using the 
body-mounted attitude gyros for attitude information and the rate gyros for rate 
information when acceleration was less than 0.05 g. For entry ( a > 0.05 g), roll commands 
for lift-vector control were generated manually by using the entry monitoring system for 
visual cues. Pitch and yaw rates were damped automatically. 

An emergency mode bypassed the control-system electronics and drove the reaction-jet 
valves directly. The resolution in attitude rate under manual control was about ±0.5 deg/sec. 
Rates up to 25 deg/sec could be commanded. During the automatic attitude-hold mode, the 
control system was capable of achieving a limit-cycle amplitude of ±0.5 deg. The deadband 
could be changed to ±5.0 deg to conserve propellant. Drift rates of less than 0.2 deg/sec 
about all three axes were expected. During entry (a > 0.05 g), the computer generated 
thruster commands to achieve the vehicle attitude required for reaching the desired 
downrange and crossrange impact point. 


2.3.3 Flight Experience 

Available reports on the first five Apollo missions include references 26, 27, 28, and 29. The 
planned entry trajectory for Apollo 7 differed slightly from the actual one, because the lift 
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vector was held at a 55 deg roll-right attitude 60 sec longer than planned. Manual control 
was used down to about 20 000 ft on Apollo 7. Control was then turned over to the digital 
autopilot. Figure 1 1 shows the propellant used during entry. The crew switched to dual 
reaction-control system operation as shown on the figure after reporting a large, 
unexplained pitch disturbance. The commanded and actual roll angles, shown on figure 1 1 
as functions of time, indicate proper response of the spacecraft to the bank-angle 
commands. 

Considerable pitch and yaw control activity occurred in the transonic region during the 
final 2 min before drogue deployment on Apollo 7. Ground simulation indicated that this 
activity was the result of thruster-jet interactions with flow around the vehicle and of strong 
winds. 

In later flights, Apollo 8, 9, 10, and 11, the entry-attitude control performed within 
nominal limits. Automatic control, with the digital autopilot, was the mode primarily used. 


2.4 X-15 Entry Control 

Three X-15 aircraft were used in a flight test program extending from 1958 to 1968. One of 
the objectives of the program was to develop and test entry-control systems for manned 
vehicles. Information on the entry-control systems, contained in references 30 to 50, is 
summarized. 


2.4.1 System Description 

The X-15 aircraft were single-place, rocket-powered vehicles that were launched from a B-52 
aircraft and self-propelled to altitudes up to 350 000 ft. They returned into the atmosphere 
without thrust at mach numbers over 6. Entry presented severe control problems because of 
the rapid increase in dynamic pressure. More than 190 research flights were made with the 
X-15 airplanes, using four modes of reaction control and three modes of aerodynamic 
control, and two airplane configurations (ventral fin on, and lower ventral fin off). When the 
original ventral-fin-on configuration exhibited undesirable augmentation-off control charac- 
teristics, the lower fin was removed. The stability and control and physical characteristics of 
these configurations are presented in detail in references 30 through 35. 

Both movable aerodynamic surfaces and jet thrusters were used to provide control torques. 
The two systems had nearly equal effectiveness when the dynamic pressure q was 10 lb /ft 2 , 
but the pilots used the jet thrusters at much higher values of q because they produced pure 
torques about each axis (e.g., the ailerons, while producing mainly roll torque, also 


17 



Roll angle, deg Propellant used, lb 



Time after digital autopilot takeover, sec 
Figure 1 1.— Apollo 7 entry data. 
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produced significant yaw torque). Two of the X-15 airplanes were equipped with three-axis 
stability augmentation. The other airplane had an adaptive rate-command-control system, 
designated the MH-96 system. Figure 12 presents the location of the control-system 
components in the vehicle. The control system is described in detail in reference 36. The 
reaction-jet thrusters provided a roll acceleration of 5 deg/sec 2 , and pitch and yaw 
accelerations of 2.5 deg/sec 2 for each of two systems. For pilot safety, two identical control 
systems were provided which operated in parallel. 


Stability-Augmentation System 

A functional diagram of the stability- augmentation system (SAS) is presented in figure 13. 
The system, described in references 36 and 37, consisted of an electronic network or 
channel for each axis. This network sensed the aircraft rate of change of pitch, roll, and yaw 
and automatically provided signals to the respective servocylinders that caused the surface 
actuators to move the horizontal and vertical stabilizers to oppose the airplane angular rates. 
Individual servocylinder outputs and the pilot’s manual inputs were combined to form a 
single input to the surface actuators. The pitch and roll channels operated singly or in 
combination at the pilot’s discretion. Because the horizontal stabilizers were used for both 
pitch and roll control, the left and right servocylinders controlled the stabilizers for both 



Figure 12.-Location of control-system components in X-15. 
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Figure 13.— Functional diagram of the stability augmentation system (SAS). 


pitch and roll damping. The yaw channel operated independently of the pitch and roll 
channels. The pilot had on-off and feedback gain control of the SAS, which enabled him to 
vary the gains throughout the flight envelope. 

The working channel drove the servocylinders. The monitor channel operated electronically 
simulated servocylinders, and compared the outputs to those of the working channel. When 
the difference between the servocylinder position and the simulated servocylinder position 
exceeded 10 percent in any channel, a failure was signaled and the servocylinder centered 
and locked, disengaging the SAS. Differences could occur because of electrical or 
mechanical malfunction. 


MH-96 Adaptive Control System 

The adaptive flight-control system (refs. 38 to 40) used on one of the aircraft was a 
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model-following rate-command system. A block diagram of the system is shown in figure 
14. This diagram is for the pitch axis but is typical of the roll and yaw axes. The principal 
features of the system were self-adjusting gains, rate-command control by the pilot, hold or 
attitude command modes of operation, normal-acceleration command and limiting, and 
automatic blending of aerodynamic and jet reaction controls. 

The system was installed so that the mechanical connection linking the pilot’s control stick 
with the surface actuators was unaltered. Manual control of the unaugmented airplane was 
unchanged. 

With the airplane stability augmented by the autopilot, input was shaped by a model to give 
the desired response. A rate-gyro signal that represented the actual airplane response 
was compared with the shaped pilot input. The signal difference was then driven to zero by a 
high-gain forward loop. The servo feedback signal was filtered, rectified, and compared with 
a set point. The sign of any difference was used to raise the gain if the servo motion was less 
than desired and lower the gain if the servo activity was greater than desired. 



Mechanical Electrical 


Figure 14.— MH-96 adaptive control-system pitch mode. 
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Reaction-Control System 


Four types of reaction-control systems were used on the X-15 (ref. 41). The basic 
reaction-control system was a pure thrust-command system, but with thrust proportional to 
stick deflection outside of a dead zone of 1 5 percent of stick travel. A second type of 
system was provided by modifying the basic reaction-control system to include reaction-rate 
damping. Two types of reaction control were available to the pilot with the MH-96 control 
system: a rate-command reaction control for manual control, and an attitude-hold control 
loop. 

The reaction-control system consisted of two independent, parallel propellant and rocket 
systems operated simultaneously by a single three-axis controller. Although satisfactory 
attitude control could be maintained with a pure thrust-command system, the pilot had to 
give considerable attention to the control task. To decrease the X-15 piloting task in the 
low- dynamic-pressure flight regions, an automatic reaction-augmentation system (RAS) was 
incorporated into the basic reaction-control systems on two aircraft. The RAS was added to 
only one of the two parallel reaction-control systems on each aircraft, which, in effect, 
limited the RAS control authority to one half that available to the pilot, who had command 
over both systems. 

A block diagram of the RAS is presented in figure 15. The RAS consisted of three rate 
gyros, located to sense the aircraft’s rotational rates about all three body axes. The gyros 
converted the vehicle’s angular rates to proportional electrical signals, which were amplified 
in the electronics section of the assembly. The signal was then used to operate an on-off 
solenoid control valve that controlled the flow of propellant to the rocket motors. Switches 
on the controller linkages prevented opposing inputs from occurring between the RAS and 
the pilot. An accelerometer unit was used to provide a signal to automatically disengage the 
system during entry after normal aerodynamic effectiveness was reestablished. 


2.4.2 Development and Flight Experience 

The major entry-control system problems encountered during the X-15 development and 
flight test program are discussed in references 42 through 50. 


Limit Cycles 

During early flights it was found that the SAS of X-15 caused the vehicle to oscillate at a 
small amplitude and at frequencies up to 3 Hz (ref. 42). These limit cycles were most 
noticeable in roll and were caused by the phase lag of hysteresis and other nonlinearities in 
the mechanical portion of the control system. Although, in general, the limit cycles were 
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Figure 15. -Typical axis of X-15 reaction augmentation system. 


only annoying to the pilot, analysis and experience showed that with the original electronic 
filter, the limit-cycle amplitude in roll abruptly increased at certain values of loop gain and 
could cause loss of control. Efforts to alleviate the problem by reducing the amount of 
hysteresis were not successful. The problem was solved by using an electronic filter that 
reduced the phase lag in the system during flight. A resonance problem still existed during 
ground tests, however, which made it necessary to reduce th ( e SAS gains while the vehicle 
was on the ground. 


Structural Resonance 

This problem induced by the SAS was encountered only after the electronic filter was 
changed to solve the limit-cycle problem. The problem appeared as a severe in-flight 
vibration of approximately 13 Hz at 170 000 ft altitude and a dynamic pressure of 100 
lb/ft 2 . The vibration was limited in amplitude because of the rate limit (25 deg/sec) of the 
control-surface actuator. The pilot stopped the vibration after about a minute by reducing 
the pitch SAS gains. A notch electronic filter for the SAS was designed to give minimum 
phase lag at limit-cycle frequencies and a maximum of attenutation at the natural 
frequencies of the structure. The filter successfully eliminated surface resonance and 
alleviated the limit-cycle problem. However, small-amplitude limit cycles persisted at some 


23 

















flight regimes. As a result of the flight experience with the modified filter, it was clear that 
both limit-cycle problems and structural coupling have to be considered simultaneously in 
the selection of acceptable control-system filters. 


Pilot /Vehicle Lateral Control Instability 

This phenomenon was observed with the X-15 simulator and later confirmed in flight 
through closely controlled tests (ref. 43). Attempts to control bank angle with normal use 
of aileron resulted in divergent oscillations in sideslip and roll, although the basic airplane 
was considered statically and dynamically stable. During studies of the problem, in which 
the X-15 flight simulator was used, it was learned that an important area in the flight 
envelope was uncontrollable without dampers. In this area, the vehicle seemed to the pilot 
to be dynamically unstable. 

An analysis of this instability revealed the cause to be an unfavorable combination of the 
yawing moment caused by aileron deflection and the dihedral effect, which was 
subsequently alleviated by removing the lower moveable ventral. The change, although 
producing lower static-directional stability and rudder effectiveness, resulted in a more 
controllable airplane with damping augmentation inoperative, particularly at high angles of 
attack. The studies of the problem indicated that extensive flight simulator tests are 
necessary to define adequately the vehicle controllability boundary and the augmented 
damper requirements. 


System Saturation Instability 

Early in the design of the adaptive controls, it was recognized that high rate commands from 
the pilot could not be followed by the control-surface actuators. Servo motion would be 
reflected back to the pilot’s stick as stick kicks, and system instability would be experienced 
because of the inability of the system to follow the commanded rate. For nearly 40 flights, 
rate-limit problems were not encountered, even during entries from the highest altitudes. 
However, the problem was experienced during a relatively routine flight and the airplane 
became uncontrollable in roll for a short time. The flight record indicated that the servo rate 
limit had been exceeded. 

The incident (ref. 47) was initiated by a rather modest pitch-control command with some 
roll command by the pilot. The resulting rate limiting of the servo produced sufficient 
system lag to reduce the pitch-damper effectiveness and to cause the roll-command system 
to go unstable. Reduced commands and adaptive gains restored the system to operational 
status, and the airplane motions were again damped. Analysis of the problem showed that 
the system nonlinear instability was caused by rate-limit-induced lag at low frequencies. The 
problem was solved by including a simple lag-lead circuit in the servo loop to reduce the lag 
at the critical low frequencies. 
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Loss of Control 


The 191st X-15 flight encountered loss of control during entry, which resulted in loss of the 
aircraft and pilot (ref. 50). 

The accident was precipitated during the ballistic portion of the flight when the pilot 
allowed the airplane to deviate in heading and subsequently flew the airplane to an extreme 
attitude with respect to the flightpath that there was loss of control during the entry 
portion of the flight. Destruction of the aircraft resulted from divergent aircraft oscillations 
that caused the aircraft’s structural limits to be exceeded. 

Additional information regarding the experience with the MH-96 Adaptive Flight Control 
System will be found in a forthcoming NASA Technical Note, “The Experience With the 
X-15 Adaptive Flight Control System,” Staff, Flight Research Center. 


Pilot Opinion 

All the X-15 pilots endorsed the blending of aerodynamic and reaction controls activated by 
the same controller. The proportional-thrust command reaction control was not appreciated 
by the pilots, nor did they use the control as a proportional-control device. In all instances, 
it was used as an on-off control. The use of rate-command reaction controls resulted in 
much more precise control and apparently consumed less fuel. The reaction augmentation 
was appreciated by the pilots. The pilots used reaction controls to dynamic pressures several 
times higher than expected. This practice resulted in the use of more reaction-control fuel 
during several entries than predicted or designed for. The deadband design of 1 5 percent ol 
stick deflection was considered excessive by the pilots. 


2.5 ASSET Entry Control 

The unmanned Aerothermodynamic/elastic Structural Systems Environmental Tests 
(ASSET) entry vehicle configuration consisted of a flat-bottomed, 70 delta wing and a 
cone cylinder body on the upper surface. The vehicle maximum LID was 1.2 and the 
WIC A was 250 lb/ft 2 . A liquid- ballast system transferred liquid mercury between forward 
and aft tanks to change the vehicle center of mass and hence the trim angle of attack. 
Control forces were provided by hydrogen peroxide jets which were activated by signals 
from the control-system electronics. Detailed data on the entry-control system may be 
found in references 51 and 52. Data regarding related systems, SLAMAST (Scout Launched 
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Advanced Materials Test Bed) and another mass shift control concept, are given in 
references 53 and 54, respectively. 


A functional diagram of the ASSET G&C hardware (a modified Scout system) is shown in 
figure 1 6. During the transition phase, when the control system helped the vehicle to attain 
trim angle of attack for glide, the pitch-control loop used attitude and rate feedback with 
deadbands of ±0.8 deg and ±2 deg/sec respectively, in conjunction with a 40-lb-thrust pitch 
down jet and a 2-lb-thrust pitch up jet. The roll system employed deadbands of ±0.8 deg for 
position and ±2 deg/sec for rate in conjunction with 15-lb jets. The yaw deadbands for the 
entire flight were ±0.4 deg for position and ± 1 deg/sec for rate. 


At the start of glide, active pitch-position control was discontinued, and a pitch-rate damper 
system having a ±1 deg/sec deadband was used to attenuate large oscillations about the 
vehicle trim. Two-lb thrusters were used for damping. During the glide phase, for periods of 
sufficient roll airframe stability, a wide position deadband of ±6 deg was used with a ±4 
deg/sec rate deadband, and during periods of marginal lateral-directional vehicle stability, a 
narrow deadband of ±0.8 deg for position and ±2 deg/sec for rate were used. At various 



Figure 16.— ASSET guidance and control system. 
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times during the flight, depending on the predicted dynamic pressure, vehicle characteristics, 
mach number, and angle of attack, the roll and yaw jets were switched between the 5- and 
15-lb thrust levels. 

The entry-control system performed satisfactorily during five suborbital ASSET flights, 
maintaining flight attitude within 3a design limits down to recovery-system deployment. 
The only flight malfunctions were intervalometer timing errors that occurred during the 
AEV-1 and AEV-3 flights. The problem was found to be caused by radiofrequency 
interference on the input power leads. Ground testing revealed several problems that were 
primarily component failures. These malfunctions occurred in the intervalometer, poppet- 
valve electronics, and in the stabilization unit. Descriptions of these failures and conclusions 
drawn therefrom are given in reference 5 1 . 


2.6 PRIME Entry Control 

The unmanned Precision Recovery Including Maneuvering Entry (PRIME) flight test 
program was conducted to demonstrate the feasibility of a maneuverable vehicle capable of 
recovering a small payload from low Earth orbit. Three flights were made using an SV-5D 
entry vehicle with a maximum L/D of 1 . 1 and W/C D A of 175 lb/ft 2 . Pitch control by means 
of a pitch flap provided downrange control. In addition, reaction jets provided control in 
pitch, roll, and yaw. 

A functional diagram of the PRIME G&C system is shown in figure 17. The modulation of 
L/D in the pitch plane controlled range of the vehicle. Modulation of the lift vector in the 
roll plane controlled crossrange maneuvering. Very little information on the PRIME 
control-system description and performance is available in the unclassified literature. Some 
data are presented in references 55 and 56. 


2.7 Future Trends and Summary 


Considerable technical literature exists on attitude-control systems not directly related to 
the space flight programs discussed previously (for example, refs. 54 to 72). Emphasis is 
currently being placed on the development of man-rated systems that are reusable without 
major refurbishment, and systems that are versatile and adaptable to a variety of missions. 

Several significant developments and trends have occurred during the evolution of 
manned-spacecraft entry-control systems. 
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Figure 17.— PRIME entry G&C system. 


The astronaut has been affirmed as the final control-system backup mode. Experience has 
shown that provisions for manual control significantly increase mission reliability. Provision 
for direct and fly-by-wire manual control and associated instrumentation and display has 
been made in all manned spacecraft to date. 

Current manned spacecraft use high-energy, fast-igniting hypergolic propellants, stainless 
steel propellant-supply systems with helium pressurization, and thrust controls employing 
on-off solenoid valves. Reliability has been the primary consideration in these choices. 

Thruster switching logic has received much attention to reduce propellant consumption and 
to improve the capabilities of attitude hold and rate command. Pulse-width, pulse-frequency 
modulation is currently in use, with consideration being given to nonlinear pulse-ratio 
modulation for future systems. 
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The use of digital adaptive-control systems is increasing as improvements are made in the 
onboard computer capabilities and in the hybrid systems necessary for this application. 

A concept of functional redundancy has emerged that does not require provision for spares 
or replacement parts to be carried along on a mission. Instead, the original design 
incorporates two nonidentical systems that overlap functionally, so that in case of the 
malfunction of one, the astronauts can complete the mission with the other. This 
philosophy is exemplified in the design of the block 2 Apollo guidance, navigation, and 
control systems. 

For vehicles that include moveable aerodynamic-control surfaces and reaction controls, pilot 
preference is for automatic blending with actuation by the same hand controller. 


3. CRITERIA 

The control system shall be designed to allow the entry vehicle to acquire and maintain the 
desired flightpath under all anticipated mission conditions. An acceptable compromise 
among performance, complexity, power consumption, propellant expenditure, weight, 
volume, and reliability shall be achieved. The entry-control system shall be as insensitive as 
practicable to off-nominal atmospheric and initial entry conditions and variations in vehicle 
aerodynamic and mass characteristics. Crew safety shall be accorded first priority in design 
decisions; however, appropriate emphasis shall be given to mission objectives. 


3.1 Performance 

It shall be demonstrated that control moments are adequate to maintain vehicle attitude and 
to provide maneuvering rates required by the mission. 


The entry-control system shall provide attitude control and maneuvering rates with specified 
accuracies. 

The entry-control system shall be stable. For any allowable set of initial conditions, the 
deviations from the commanded flightpath and attitude should become or remain smaller 
than acceptable bounds established by mission requirements. The closed-loop response shall 
exhibit adequate damping and acceptable natural frequencies. 

The entry-control system shall be designed to be as insensitive as possible to changes in 
vehicle characteristics, control-system hardware, guidance requirements, and environmental 
changes. 
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The control system should not excite vehicle structural oscillations that will impair 
flightworthiness. 

The control logic should be as simple as possible to perform the required functions. It 
should require as little computation time as practicable consistent with performance 
requirements. 

The reaction-jet fuel allotted for entry shall be commensurate with the required control 
accuracy and safety. 

The control system shall be capable of maintaining the vehicle attitude within specified 
attitude boundaries consistent with vehicle load and heating constraints. The total number 
of jet firings required for control during entry shall be compatible with duty cycle, fuel 
reserve and endurance limits of the thrusters. 


3.2 Crew Safety and Flightworthiness 

The designer must quantitatively demonstrate with a high level of confidence that no 
characteristic of the entry-control system could compromise crew safety or impair 
flightworthiness. The demonstration shall be validated through a series of analytical studies, 
component tests, system tests, simulations, and flight tests. All anticipated configurations, 
missions, flight conditions and-system modes of operation shall be considered. 

Failure of any individual component or subsystem shall not prevent safe completion of 
entry. 

Equipment reliability shall meet specified mission requirements. 

Malfunction-detection and system-monitoring equipment shall be provided to enable the 
crew to recognize the need for a mode change prior to and during entry. All monitors and 
controls shall be simple, functionally straightforward, and readily identifiable to facilitate 
rapid and accurate crew performance. 

All controls, switches, and displays should be designed to insure operation in the intended 
manner. Interlocks should be provided to prevent inadvertent mode switching or other 
improper operation. Positive safeguards should be provided to prevent any crew operations 
that could have catastrophic results. 
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3.3 Additional Considerations 

The entry-control-system design should make effective use of sensors, computers, displays, 
and other equipment that are onboard the vehicle for other mission phases. It shall be de- 
signed to operate within spacecraft and total system constraints, such as weight, power, 
volume, computer memory, computer execution time, and propellant weight. 

The entry-control system should be of a modular design with ready accessibility for ease of 
inspection, testing, and maintenance. 

All interfaces (mechanical, electrical, structural, environmental, computational, crew, etc.) 
should be compatible with adjoining systems. 


4. RECOMMENDED PRACTICES 

Procedures and recommended practices for the design of stabilization and control systems 
for entry vehicles and for the analysis, simulation, and test of such systems are presented. 


4.1 Statement of the Problem 

It is recommended that at the inception of a spacecraft development program the designer 
obtain a clear description of the functions to be performed, a definition of the system and 
vehicle interfaces, a numerical specification of the required control-system performance 
during entry, and reliability goals for crew safety and mission success. Quantitative control 
requirements and specifications will be determined by the specific mission objectives and 
mission constrained entry vehicle characteristics. 

It is often not possible to define the entry-control requirements uniquely during the initial 
design phase. It is important to recognize that the design and development of the spacecraft 
and its subsystems will be iterative because requirements are time-variant and may change 
radically, initial design constraints are generally ill defined, inherent characteristics of the 
spacecraft are not well known, and basic input data for control-system design is frequently 
not available when needed. Experience has shown that cost, schedule, and other constraints 
often force major control-system design decisions in spite of the lack of fundamental 
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information. It is recommended that the designer develop a philosophy of building as much 
flexibility and adaptability into the entry-control design as practicable to accommodate 
future contingencies or unexpected problems. In practice, the acceptability of the 
entry-control system is often judged by performance under extreme off-nominal conditions. 

Requirements and constraints should be established for the two distinct flight phases during 
which the entry-control system must operate: 

(1) The extra-atmospheric portion subsequent to retrofire or final staging, and prior to 
sensible atmosphere drag deceleration (0.05 g). In this phase, the control system must 
be capable of holding the required vehicle attitude within specified limits without 
using excessive propellant. 

(2) The atmospheric portion subsequent to 0.05 g drag and prior to entry into the 
terminal landing mode. In this phase, the entry-control system must be capable of 
controlling attitude and attitude rate within specified limits, and damping any vehicle 
instability. 

The entry-attitude and attitude-rate accuracy requirements are of fundamental importance 
to the design of the entry-control system. However, the complexity of the control itself in 
terms of lofeic, signal processing, etc., will increase rapidly as the required control accuracy 
increases: therefore, caution should be exercised to avoid overspecification. The angular- 

acceleration requirements to perform maneuvers often determine the maximum level of 
control torque to be provided by the reaction-jet system. For example, during supeiciicular 
entry, critical roll maneuvers must be conducted in a very short time during the maximum 
g-loading period to establish the proper skipout conditions. This rapid-control-response 
requirement during initial entry sized the roll reaction-jet thrust magnitude for the Apollo 
CM. 

Other data that the entry-control designer must obtain early in the design include 
preliminary estimates of vehicle geometry; inertial and hypersonic aerodynamic characteris 
tics; vehicle heating and loading limitations; time histories of typical entry- trajectory 
characteristics; constraints on weight, power, and volume; and other requirements such as 
those concerning vibration, mechanical, thermal, humidity, and radiation environments. It is 
recommended that the sensors, computers, thrusters, and other equipment onboard the 
vehicle for other mission phases be used for the entry-control system whenever possible. 
Thus, it is desirable that the entry-control designer have detailed information on the total 
mission G&C system as soon as it becomes available and insure that any requirements 
unique to the control system are included in component specifications. In particular, such 
information as reaction-jet propulsion-system data including jet interference estimates (refs. 
73 and 74), propellant-weight limitations, computer memory, and execution-time con- 
straints should be provided. Initially, the above information will, of necessity, be 
preliminary. As the mission plan and spacecraft design progresses, this information should 
be updated. 
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4.2 Performance 

Analytical studies, simulation studies, and tests should be conducted to insure that the 
entry-control-system performance is adequate to fulfill mission requirements. The following 
practices are recommended for the conduct of these studies. 


4.2.1 Performance Analysis 

Initial studies should be conducted to determine required performance ranges of the 
entry-control system and all components, insofar as this is practicable. A dynamic 
mathematical model of the spacecraft should be developed (ref. 44) that includes the 
rigid-body dynamics with the kinematic representations, sensor representations, and the 
complete mathematical model of the control elements. 

The initial spacecraft model may include only the primary dynamic effects, neglecting such 
effects as variable vehicle mass, structural flexibility, and fuel sloshing. The analysis should 
involve a three-degree-of-freedom rotational model in which only the orientations and 
angular velocities of the vehicles are involved. Euler equations or Quaternians, for large 
flightpath angles, in nonprincipal axes for the vehicle rotational accelerations about the 
yaw, pitch, and roll axes such as those used in references 56 and 75 are recommended. 

Candidate entry-control systems should be formulated that use to maximum advantage 
sensors, computers, displays, and thrusters already planned for installation in the vehicle for 
other mission phases. These configurations should be investigated initially by linear-analysis 
techniques (refs. 76 to 80), using the rigid-body dynamic model, assuming all axes 
uncoupled. Minimum bandwidth consistent with performance requirements should be 
selected. Gain and phase margins should be established to satisfy performance and stability 
requirements. Frozen-point analyses at representative points along the entry trajectory 
should be made, including such critical conditions as the maximum-dynamic-pressure point 
and the maximum-heating-rate point. During these initial studies, it should be determined 
which of the candidate configurations is most suitable and whether slight relaxation of 
performance requirements permits significant simplification of the control system. 

The stability analysis conducted at this point should employ root-locus, Bode, or Nyquist 
diagram techniques (refs. 81 to 83). The analysis may be generalized to handle quasi-linear 
system configurations if required (ref. 84). This analysis should investigate transient 
response, steady-state control errors, the sensitivity of the candidate systems to parameter 
changes, and the extent to which linear control-system techniques are applicable. Other 
methods of analysis of nonlinear systems, including the methods of Lyapunor (ref. 85), may 
be used in certain cases. 
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Where “hard” nonlinearities (deadbands, etc.) are included in the controller, there is no 
region of linear system operation. In that event, quasi-linearization (describing function) or 
phase-plane analysis is performed to study the nonlinear elements (ref. 86). If the controller 
contains sampled-data elements, it is often necessary to use z-transform techniques to study 
the system (ref. 81). In some cases, when the sampling frequency is high compared to other 
modes of the system, the sampled-data subsystem may be analyzed as an equivalent 
continuous system. Caution must be used, however, because the continuous analysis will not 
display instability and poor transient response, which may be produced by the effects of a 
finite sampling rate. A z-transform analysis is usually necessary if the sample frequency is 
less than 1 0 times larger than the highest significant frequency component of the input to 
the sampled-data system, or if the sampled-data output frequency can excite elements of the 
control loop. 

4.2.2 Simulation Studies 

Simulation studies of the selected entry-control system configuration should be conducted 
throughout the design, test, and operational program to insure that the system is safe and 
flightworthy. The studies may begin using computer simulations and rudimentary displays 
and controls. Increasing realism should be incorporated in these studies as the design 
progresses. Through these studies, the effects of faulty operation of system elements, crew 
errors, and off-nominal conditions should be considered to insure that all factors that might 
impair safety of flight are fully understood and are appropriately eliminated. 

It is recommended that a digital or hybrid six-degree-of-freedom simulation be used to 
conduct these studies. Methods such as those used in reference 87 are recommended for this 
simulation. The simulation should include man-in-the-loop investigations of the entry- 
control system coupled with the entry-guidance system. Depending on the vehicle 
configuration, effects such as structural flexibility and propellant slosh should be 
investigated. As various system components become defined and available, the actual 
hardware elements should be tied into the simulation. This practice will allow an 
understanding and verification of the hardware and software interfaces between the 
entry-control elements and other subsystems. 

Parametric studies to generate technical data to be used for tradeoff decisions should be 
conducted. It is recommended that the parametric investigation include a determination of 
the effects of the following: 

( 1 ) Aerodynamic-coefficient uncertainties 

(2) Moment-of-inertia uncertainties 

(3) Principal axes misalinements 

(4) Attitude- and rate-control gain 

(5) Center-of-mass location 

(6) Entry angle of attack 
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(7) Landing target location 

(8) Magnitude of attitude-rate commands 

(9) Attitude and rate deadbands 

( 1 0) Roll-yaw coupling gain 

(11) Reaction-jet thrust plus interference level 

( 1 2) Gusts and wind shears 

(13) Single-thruster failure 

( 1 4) Single- versus dual-thruster system operation 

(15) Rate-to-attitude signal mixing ratio 

(16) Pulse-modulation methods for thrusting commands 

( 1 7) Transonic region jet/airflow interaction 

The results of the parametric investigation should be analyzed to determine the effects of 
the preceding on the following: 

(1) Propellant consumption during entry 

(2) Maximum on-time for any thruster 

(3) Number of thruster firings 

(4) Touchdown accuracy of controlled entry 

(5) Angle-of-attack oscillations during maximum heating, maximum dynamic pressure, 
and transonic flight 

(6) Tolerances on c.m. location 

(7) Control-system sensitivity to landing location 

(8) Limits on gain variations 

With this information, decisions relative to system tradeoffs may be made. 


4.2.3 Tests 

The test plan should be formulated to include performance tests to insure that system and 
component performance is adequate to meet all anticipated requirements, and to include 
acceptance tests to insure that flight hardware conforms to design performance require- 
ments. 

The test plan should include such laboratory and flight tests as are required to insure that 
assumptions regarding safety and effects of failure are realistic. The test plan should also 
include qualification tests to demonstrate the adequacy of flightworthiness of the design. 

Any interface problems must be worked out at this time to insure that the integrated system 
operates as planned in all modes. Tests for electromagnetic interference effects should be 
performed to verify that no such problems exist. Closed-loop operation of the system 
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should be checked for all anticipated mission conditions. Final software tests should be 
conducted to verify the compatibility of the generated commands with the flight programs 
and mission requirements. Complete man-in- the-lo op simulations energizing all the actual 
hardware components of the control system should be carried out as a final check of the 
selected system configurations. 

After all analyses, simulation, and ground tests have been completed, a flight test program 
should be considered. For the manned system, a flight test program to insure satisfaction of 
the crew safety criteria should be combined with other tests to qualify structure, heatshield, 
etc., if practicable. 


4.3 Crew Safety and Mission Success 

Early in the design, overall crew safety and mission success goals are established. Crew safety 
goals expressed in probability terms are typically on the order of 0.995 to 0.999. Mission 
success goals may fall in the range of 0.90 to 0.95. The entry-control system contribution to 
the overall crew safety and mission success probabilities must be determined. It is 
recommended that the techniques of references 88 and 89 be used to determine the 
entry- control- system contribution to crew safety and mission success. In carrying out this 
analysis, the basic elements of the control system, including primary, monitor, and backup 
subsystems, should be arranged into reliability logic diagrams according to their function. 
From these diagrams, equations defining the probability of successful operation are derived. 
Component-reliability test data are used to establish the required probabilities that 
contribute to the control-system total. This analysis should be repeated throughout the 
design process to verify entry-control-system compliance with the crew safety and mission 
success criteria. 

A failure analysis should be conducted to determine the effects of failure of each wire, joint, 
terminal, etc., to insure that no single failure can impair mission completion and that no 
combination of two single failures impairs flight safety. This analysis will serve to identify 
potential failures and to provide a basis for determining redundancy requirements. In 
considering the degree of redundancy to be used, only that amount of redundancy necessary 
for meeting the reliability goals should be used. Thus, excesses in weight, size, power, 
complexity, and cost will be minimized. Nonredundant designs, when compared to 
redundant designs, usually result in equipment that is smaller in size and lighter in weight, 
requires less power, and is less complex. However, the high reliability goals of manned 
control systems and the numerous connections and dissimilar elements included in control 
systems in general dictate that some degree of redundancy be used in the design. Re- 
dundancy and backup provisions should be provided wherever necessary to achieve mission 
reliability goals. 
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Provision should be made for monitoring the operational status of all critical system 
elements. Wherever manual switchover is relied upon, information provided to the crew 
should be clear, easily comprehended, legible, and entirely appropriate for the intended 
purpose. Transition between primary and secondary systems should be accomplished 
without undesirable transients. Interlocks should be provided wherever inadvertent 
switching could compromise flightworthiness. 

Crew safety considerations dictate that two independent reaction-jet systems with separate 
propellant supplies, each system adequate to insure safety of flight throughout critical 
phases of entry, should be provided. Flight-proven hardware should be used wherever such 
equipment is compatible with reliability and safety-of-flight goals and other design 
constraints. 
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NASA SPACE VEHICLE DESIGN CRITERIA 
MONOGRAPHS ISSUED TO DATE 


SP-8001 (Structures) 
SP-8002 (Structures) 

SP-8003 (Structures) 
SP-8004 (Structures) 
SP-8005 (Environment) 
SP-8006 (Structures) 

SP-8007 (Structures) 

SP-8008 (Structures) 
SP-8009 (Structures) 
SP-80 1 0 (Environment) 
SP-8011 (Environment) 
SP-80 12 (Structures) 
SP-80 13 (Environment) 

SP-80 14 (Structures) 

SP-80 15 (Guidance and 
Control) 

SP-80 16 (Guidance and 
Control) 


Buffeting During Launch and Exit, May 1964 

Flight-Loads Measurements During Launch and Exit, December 
1964 

Flutter, Buzz, and Divergence, July 1964 

Panel Flutter, May 1965 

Solar Electromagnetic Radiation, June 1965 

Local Steady Aerodynamic Loads During Launch and Exit, 
May 1965 

Buckling of Thin-Walled Circular Cylinders, revised August 
1968 

Prelaunch Ground Wind Loads, November 1965 

Propellant Slosh Loads, August 1968 

Models of Mars Atmosphere (1967), May 1968 

Models of Venus Atmosphere (1968), December 1968 

Natural Vibration Modal Analysis, September 1968 

Meteoroid Environment Model— 1969 (Near Earth to Lunar 
Surface), March 1969 

Entry Thermal Protection, August 1968 

Guidance and Navigation for Entry Vehicles, November 1968 

Effects of Structural Flexibility on Spacecraft Control Systems, 
April 1969 
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SP-8017 (Environment) 

SP-80 18 (Guidance and 
Control) 

SP-80 19 (Structures) 

SP-8020 (Environment) 

SP-8021 (Environment) 

SP-8023 (Environment) 

SP-8024 (Guidance and 
Control) 

SP-8029 (Structures) 

SP-8031 (Structures) 
SP-8032 (Structures) 


Magnetic Fields-Earth and Extraterrestrial, March 1969 
Spacecraft Magnetic Torques, March 1969 

Buckling of Thin-Walled Truncated Cones, September 1968 

Mars Surface Models (1969), May 1969 

Models of Earth’s Atmosphere (120 to 1000 km), May 1969 

Lunar Surface Models, May 1969 

Spacecraft Gravitational Torques, May 1969 

Aerodynamic and Rocket-Exhaust Heating During Launch and 
Ascent, May 1969 

Slosh Suppression, May 1969 

Buckling of Thin-Walled Doubly Curved Shells, August 1969 
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